[self-care:open-source-failures] Live-mode target authority missing for repeated CAO maintenance runs

Live-mode admission is being denied for several `githubnext/gh-aw-cao` maintenance workflows because control precompute reports missing target authority, causing 20 failed runs in the bounded seven-day snapshot. The strongest evidence is the repeated pre-activation error `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`.

**Action:** A CAO maintainer should verify the target-authority configuration expected on the default branch and either restore the required `.github/workflows/cao.json` declaration or downgrade these workflows out of live mode; accept when a rerun of one affected workflow passes `Run CAO control precompute`.

Affected workflows:
- `.github/workflows/aw-failures-investigator.lock.yml`
- `.github/workflows/aw-maintenance-compiler-security.lock.yml`
- `.github/workflows/aw-maintenance-upgrade.lock.yml`
- `.github/workflows/dependabot-release-train-updater.lock.yml`

Representative run:
- https://github.com/githubnext/gh-aw-cao/actions/runs/33971629926

Evidence-supported probable cause: the workflows are requesting live-mode target authority that the target default branch does not currently declare. The bounded snapshot does not show whether this is due to misconfiguration, stale rollout policy, or an authority file regression.

Reviewer decision needed
This needs a maintainer decision because it changes live-mode authority. Confirm whether these workflows should retain live target writes. If yes, restore the required target-authority declaration on the default branch. If not, change rollout policy or workflow ceilings so they run in review mode instead.

Cluster evidence

- Severity: P1
- Normalized signature: `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- Run count in bounded snapshot: 20
- Confidence: high
- Why P1: the same actionable configuration error recurred across multiple runs and workflows.

### Control Plane
- Correlation ID: `33974803640-229`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/33974803640

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33974992569) · pi · gpt54 · 38 AIC · ⌖ 8.57 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 3:34 PM UTC

Review the four affected .github/workflows/*.lock.yml files and the target default branch’s .github/workflows/cao.json declaration, starting with the representative run and its Run CAO control precompute error. A CAO maintainer must decide whether live target writes remain authorized, then restore the declaration or change the workflows to review mode. Done means a rerun of one affected workflow passes Run CAO control precompute.

Written by the indexing model from the issue text.